Decode a JWT Without Pasting Production Tokens Into Random Websites

Debugging auth usually goes like this: a request fails with 401, you copy the Authorization: Bearer eyJ... header, paste it into the first JWT decoder Google gives you, and look at exp. That token is